NtQueryInformationProcess (ProcessImageInformation, 0x25)

//http://waleedassar.blogspot.com/   (@waleedassar)
//The undocumented ProcessImageInformation 0x25 of the "ZwQueryInformationProcess" function.
//This can be used to retrieve various useful info. about a running process. e.g. its entrypoint, whether it has been relocated, file size, etc...

#pragma comment(linker,"/FIXED:NO")
#pragma comment(lib,"ntdll.lib")

struct PROCESS_IMAGE_INFORMATION
{
   unsigned long EntryPoint; //after relocation
   unsigned long unk1;
   unsigned long SizeOfStackReserve;
   unsigned long SizeOfStackCommit;

   unsigned short subsystem;
   unsigned short unk2;
   unsigned short MinorSubSystemVersion;
   unsigned short MajorSubsystemVersion;
   unsigned long unk3;
   unsigned short characteristics;
   unsigned short dll_characteristics;

   unsigned short machine;
   unsigned short flags;  //0x0400--->FLAG_IMAGE_RELOCATED 0x1---->???
   unsigned long LoaderFlags;
   unsigned long FileSize;  //on disk
   unsigned long Checksum;
};

extern "C"
{
        int __stdcall ZwQueryInformationProcess(HANDLE,int,PROCESS_IMAGE_INFORMATION*,unsigned long,int*);
}

int main(void)
{
        PROCESS_IMAGE_INFORMATION Q={0};
        ZwQueryInformationProcess(GetCurrentProcess(),0x25,&Q,sizeof(Q),0);
        printf("My Entrypoint is %X\r\n",Q.EntryPoint);
        return 0;